Azure AD B2C Custom policy goes to start of user journey after OTP verification

Question

I'm using the reset password sample from the Azure AD B2C samples repository:

https://github.com/azure-ad-b2c/samples/tree/master/policies/pwd-reset-email-exists

I'm experiencing a timeout/expiry issue in the user journey - below are the reproduction steps:

1. Enter user email in Forgotten password flow
2. Click on Send verification code.
3. User will receive the OTP but do not enter it.
4. Wait for 10 minutes.
5. Click on Send new code
6. Wait for 15 mins and enter the OTP.
7. Click on Verify Code.

The verification succeeds, but once I click on continue, I should expect to see the password input screen. However, I am simply redirected to the beginning of the user journey and forced to enter my email, and go through the OTP verification again.

If I enter the OTP within minutes of receiving it, there isn't any issue. The issue only occurs after waiting for 10 and 15 minutes respectively. I am suspecting that there is some timeout or session expiration but I couldn't find anything on the documentation which addresses this.

Any help would be appreciated.

Answer 1

By default ,the expiry time of email verification code is 5 minutes and we can not change it or extend it.

If you need to disable email verification system. You can refer Disable Email verification

Also ,we need to note that when the MFA is activated for the self-service password reset for a SignIn user flow you may have to verify the e-mail twice.

Please check if custom policy for OTP technical profile can be created (if needed) , where we can give CodeExpirationInSeconds

<TechnicalProfile Id="GenerateCode">
  <DisplayName>Generate Code</DisplayName>
  <Protocol Name="Proprietary" Handler="Web.TPEngine.Providers.OneTimePasswordProtocolProvider, Web.TPEngine, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
  <Metadata>
    <Item Key="Operation">GenerateCode</Item>
    <Item Key="CodeExpirationInSeconds">600</Item>
    <Item Key="CodeLength">6</Item>
    ...
    ...
  </Metadata>
  <InputClaims>